system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-20 02:57:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

leds: lp5523: fix out-of-bounds bug in lp5523_selftest()

Browse source 
When not all LED channels of the led chip are configured, the
sysfs selftest functionality gives erroneous results and tries to
test all channels of the chip.
There is a potential for LED overcurrent conditions since the
test current will be set to values from out-of-bound regions.

It is wrong to use pdata->led_config[i].led_current to skip absent
channels as led_config[] only contains the configured LED channels.

Instead of iterating over all the physical channels of the device,
loop over the available LED configurations and use led->chan_nr to
access the correct i2c registers. Keep the zero-check for the LED
current as existing users might depend on this to disable a channel.

Reported-by: Arne Staessen <a.staessen@televic.com>
Signed-off-by: Maarten Zanders <maarten.zanders@mind.be>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
This commit is contained in:
Maarten Zanders 2022-10-28 12:56:43 +02:00 committed by Pavel Machek
parent 5f52a8ba7e
commit 17c13c724b
1 changed files with 15 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
drivers/leds/leds-lp5523.c
View file

@ -581,8 +581,8 @@ static ssize_t lp5523_selftest(struct device *dev,
struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
struct lp55xx_chip *chip = led->chip;
struct lp55xx_platform_data *pdata = chip->pdata;
int i, ret, pos = 0;
u8 status, adc, vdd;
int ret, pos = 0;
u8 status, adc, vdd, i;
mutex_lock(&chip->lock);
@ -612,20 +612,21 @@ static ssize_t lp5523_selftest(struct device *dev,
vdd--; /* There may be some fluctuation in measurement */
for (i = 0; i < LP5523_MAX_LEDS; i++) {
/* Skip non-existing channels */
for (i = 0; i < pdata->num_channels; i++) {
/* Skip disabled channels */
if (pdata->led_config[i].led_current == 0)
continue;
/* Set default current */
lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + i,
lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + led->chan_nr,
pdata->led_config[i].led_current);
lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + i, 0xff);
lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + led->chan_nr,
0xff);
/* let current stabilize 2 - 4ms before measurements start */
usleep_range(2000, 4000);
lp55xx_write(chip, LP5523_REG_LED_TEST_CTRL,
LP5523_EN_LEDTEST | i);
LP5523_EN_LEDTEST | led->chan_nr);
/* ADC conversion time is 2.7 ms typically */
usleep_range(3000, 6000);
ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
@ -633,20 +634,22 @@ static ssize_t lp5523_selftest(struct device *dev,
goto fail;
if (!(status & LP5523_LEDTEST_DONE))
usleep_range(3000, 6000);/* Was not ready. Wait. */
usleep_range(3000, 6000); /* Was not ready. Wait. */
ret = lp55xx_read(chip, LP5523_REG_LED_TEST_ADC, &adc);
if (ret < 0)
goto fail;
if (adc >= vdd || adc < LP5523_ADC_SHORTCIRC_LIM)
pos += sprintf(buf + pos, "LED %d FAIL\n", i);
pos += sprintf(buf + pos, "LED %d FAIL\n",
led->chan_nr);
lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + i, 0x00);
lp55xx_write(chip, LP5523_REG_LED_PWM_BASE + led->chan_nr,
0x00);
/* Restore current */
lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + i,
led->led_current);
lp55xx_write(chip, LP5523_REG_LED_CURRENT_BASE + led->chan_nr,
led->led_current);
led++;
}
if (pos == 0)